1. Subject matter and duration
The subject matter is the processing of personal data when providing LogCon as software as a service. The duration corresponds to the term of the main contract.
2. Nature and purpose of processing
Transport management, AI-supported order handling, dispatch, communication with customers, carriers and drivers, document creation, customs preparation and billing.
3. Data categories and data subjects
- Controller's employees: name, e-mail, phone, role, language, login data
- Drivers (own and subcontractors'): name, phone, language, qualifications, position data during tours
- Contacts at customers and carriers: name, contact details, communication content
- Order, document, customs and invoice data with personal reference
4. Obligations of the processor
- Processing only on documented instructions of the controller
- Confidentiality obligation for all authorised persons
- Implementation of the technical and organisational measures (annex 1)
- Support with data subject rights, data protection impact assessments and notification duties
- Informing the controller if an instruction, in the processor's view, infringes data protection law
5. Sub-processors
The controller approves the sub-processors listed in annex 2. The processor informs the controller of intended changes at least 30 days in advance; the controller may object for good cause under data protection law.
6. Technical and organisational measures (annex 1)
- Physical access control: EU data centre with ISO 27001 certification, no physical access by the processor's staff
- System access control: bcrypt-hashed passwords, two-factor authentication, lockout after failed attempts, expiring JWT, API keys stored as hashes only
- Data access control: role-based permissions, least privilege, platform-wide administration only with permissions verified in the database
- Separation control: tenant ID on every table, separate storage paths per tenant
- Encryption: TLS in transit, AES-256-GCM for integration credentials, disk encryption at the hosting provider
- Input control: audit log with before/after state for changes and AI actions
- Transfer control: HMAC-signed webhooks, outgoing e-mails only via configured servers
- Availability: daily encrypted backups of database and documents, retaining 7 daily, 4 weekly and 12 monthly backups, encrypted off-site copy at a second provider, documented restore procedure, monitoring
- Data protection management: record of processing activities, deletion concept, incident response process
7. Notification of data breaches
The processor reports personal data breaches without undue delay, at the latest within 24 hours of becoming aware, with the information pursuant to Art. 33(3) GDPR.
8. Audit rights
The controller may verify compliance with this agreement by inspecting evidence and reports and, after timely notice, by on-site audits.
9. Deletion and return
After the contract ends, the processor makes a complete data export available for 30 days, then deletes all of the controller's data including copies and confirms the deletion. Statutory retention obligations remain unaffected; encrypted backup copies are overwritten in the regular rotation cycle, at the latest after 12 months.
10. Third-country transfers
Transfers to third countries only take place under the conditions of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision or standard contractual clauses.
11. AI transparency (annex 4)
AI agents create proposals or – depending on the autonomy level set by the controller – execute actions. Every AI action is logged with model, time, confidence and before/after state; automatic actions are reversible. Customer data is not used to train AI models.
12. Final provisions
In case of conflict, this agreement takes precedence over the main contract in matters of data protection. Austrian law applies; place of jurisdiction is Wien.
Annex 2: sub-processors
See the following table.
Sub-processors and recipients
The following service providers process personal data on our behalf. We announce changes to customers at least 30 days in advance.
| Provider | Purpose | Data categories | Location / legal basis |
|---|---|---|---|
| (to follow) | Operation of application, database, file storage and backups | All data stored in the service | EU – (to follow); DPA, technical measures described in the TOMs |
| Anthropic PBC | AI models (Claude) for agents and Copilot | E-mail content, document text, order and master data as context of the respective request | USA – third country; standard contractual clauses or EU-US Data Privacy Framework; no training on customer data |
| Stripe Payments Europe, Ltd.only for paid subscriptions | Billing of paid subscriptions | Name, e-mail address, billing address; payment data is collected by Stripe directly | Ireland (EU); transfer to Stripe, Inc. (USA) possible – standard contractual clauses |
| (to follow) | Sending system e-mails (e.g. confirmations, password reset, notifications) | E-mail address, name, message content | (to follow) |
| OpenStreetMap services (Nominatim, OSRM)optional, depending on configuration | Address geocoding and route calculation | Addresses (company addresses) or coordinate pairs – no personal data | EU/UK or depending on server; own instances recommended in production |
| Telematics providers (e.g. Webfleet, Samsara)only if activated by the customer | Import of vehicle positions | Position data, vehicle identifiers | Contract between customer and provider; LogCon only provides the interface |
| TIMOCOM GmbHonly if activated by the customer | Freight exchange | Freight offers, company contacts | Germany; contract between customer and provider |